Install and configure LexyBox

Server Requirements

Important Package Files

1. Create and Import the Database

Copymysql -u YOUR_DATABASE_USER -p YOUR_DATABASE_NAME < database/schema.sql

2. Upload the Web Files

Upload the backend and admin folders under the same website root. A typical layout is:

public_html/
└── lexybox/
    ├── backend/
    │   ├── api/
    │   ├── config/
    │   ├── controllers/
    │   └── tools/
    └── admin/
        ├── assets/
        └── uploads/

3. Edit the PHP Configuration

Open backend/config/config.php and replace all database credentials, URLs, and secret values.

Copydefine('DB_HOST', 'localhost');
define('DB_PORT', '3306');
define('DB_NAME', 'lexybox');
define('DB_USER', 'lexybox_user');
define('DB_PASS', 'USE_A_STRONG_DATABASE_PASSWORD');

define('APP_URL',   'https://your-domain.com/lexybox/backend');
define('ADMIN_URL', 'https://your-domain.com/lexybox/admin');

define('JWT_SECRET',    'GENERATE_A_NEW_RANDOM_SECRET');
define('STREAM_SECRET', 'GENERATE_A_DIFFERENT_RANDOM_SECRET');

Generate secure secrets

Copyphp -r "echo bin2hex(random_bytes(32)), PHP_EOL;"

Test the API

https://your-domain.com/lexybox/backend/api/index.php?route=settings

A JSON response confirms that PHP routing and the database connection are working.

4. Connect Your Plex Server

5. Secure and Configure the Admin Panel

• Set the application name and theme.
• Enable or disable public registration.
• Configure activation codes and allowed usage count.
• Set maintenance mode and DEV login permissions.
• Configure splash-screen video and enable switch.
• Configure default subtitle style for new users.
• Set movie/series details-card layout.
• Select the main-screen theme.
• Create users, moderators, and administrators.
• Set account expiry and connection limits.
• Configure app update releases.
• Back up the portable intro/outro marker database.

6. Configure the Compiled Android APK

Customers receive a compiled APK, not the original Android source code. The compiled APK must be decompiled, configured with the customer's panel/API URL, rebuilt, aligned, and signed.

Required tools

• Java/JDK 17 or newer
• Apktool
• Android SDK Build Tools containing zipalign and apksigner
• A text editor that can search all files in a folder

Step A — Decompile the supplied APK

Copyjava -jar apktool.jar d LexyBox.apk -o LexyBox-decompiled

Step B — Find the existing server address

Search every file inside LexyBox-decompiled for the word smazze. Replace every LexyBox server/API URL belonging to that host with your own installation URL.

Windows PowerShell search:

CopyGet-ChildItem -Path .\LexyBox-decompiled -Recurse -File |
  Select-String -Pattern 'smazze' |
  Select-Object Path, LineNumber, Line

Linux/macOS search:

Copygrep -Rni "smazze" LexyBox-decompiled

Replace the old API address with your complete API endpoint, for example:

https://your-domain.com/lexybox/backend/api/index.php

Step C — Confirm the old host is gone

Run the same search again. It should return no remaining production references to smazze.

Step D — Rebuild the APK

Copyjava -jar apktool.jar b LexyBox-decompiled -o LexyBox-unsigned.apk --use-aapt2

Step E — Align the APK

Copyzipalign -p -f 4 LexyBox-unsigned.apk LexyBox-aligned.apk

Step F — Sign the APK

Create a signing keystore only for the first release. Save it permanently; every future update must use exactly the same keystore.

Copykeytool -genkeypair -v -keystore lexybox-release.jks -alias lexybox -keyalg RSA -keysize 2048 -validity 10000

Copyapksigner sign --ks lexybox-release.jks --ks-key-alias lexybox --out LexyBox-release.apk LexyBox-aligned.apk

Copyapksigner verify --verbose --print-certs LexyBox-release.apk

Step G — Test before distribution

• Install the APK on a test phone and Android TV/box.
• Confirm login reaches your own panel.
• Confirm Plex libraries, posters, details, and playback work.
• Confirm registration, messages, subtitles, audio, and settings work.
• Confirm the APK can update a previous release without uninstalling it.

Cron, Cache, and Synchronization

Use the sync URL and security key configured in the panel when scheduling Plex synchronization. Never publish the sync key.

https://your-domain.com/lexybox/backend/api/index.php?route=plex/sync&key=YOUR_SYNC_SECURITY_KEY

Recommended cron interval: every 15–60 minutes, depending on library size. Use the panel’s cache controls after changing Plex libraries or metadata.

Complete Feature Overview

Production Security Checklist

• Use HTTPS for the panel, API, and Plex server.
• Change the default admin password immediately.
• Generate unique JWT and stream secrets.
• Replace all sample database credentials.
• Replace any Plex URL/token imported by the SQL file.
• Keep debug mode disabled for normal users.
• Protect and back up the Android signing keystore.
• Restrict database access to the web server.
• Keep PHP and MySQL updated.
• Back up the database and marker database regularly.
• Do not expose config.php, sync keys, or Plex tokens.
• Use strong activation codes and expiry dates.

Troubleshooting